In Linux, the use of deleting rm commands should be cautious. Sometimes important files are deleted due to misoperation. At this time, don't be too nervous. If you operate properly, you can still recover.
EXT Type File Recovery
Deleting a file does not actually clear the inode node and block data, but deletes the name of the file in the block in the file's parent directory. Linux controls file deletion by the number of links, and only when a file does not have any links will the file be deleted.
Of course, what I'm referring to here is the complete deletion, that is, the situation that can't be retrieved through the recycle bin, such as using Rm-rf to delete data. For the EXT file system under Linux, the available recovery tools are debugfs, ext3grep, extundelete and so on. Extundelete is an open source Linux data recovery tool that supports ext3 and ext4 file systems.
After the data is deleted by mistake, the first thing to do is to uninstall the partition where the deleted data is located. If the data of the root partition is deleted by mistake, it is necessary to enter the system into single-user mode and mount the root partition in read-only mode. The reason for this is simple, because after deleting the file, only the sector pointer in the inode node of the file is cleared, and the actual file is also stored on the disk. If the disk continues to mount in read-write mode, the data blocks of the deleted files may be reassigned by the operating system, and these databases will be new. After data coverage, these data are really lost and recovery tools are powerless. Therefore, mounting disks in read-only mode can minimize the risk of data coverage in the database, so as to improve the success rate of data recovery.
Demo
Before compiling and installing extundelete, you need to install two dependency packages e2fsprogs-libs and e2fsprogs-devel, which are available in the system installation CD/Package directory and are installed using rpm or yum commands. E2fsprogs-devel installation depends on the libcom_err-devel package.
1. The system uses RHEL 6.5 to mount CD-ROM and install dependency packages. The rpm installation mode is used here.
[root@localhost ~]# mkdir /mnt/cdrom [root@localhost ~]# mount /dev/cdrom /mnt/cdrom/ mount: block device /dev/sr0 is write-protected, mounting read-only
[root@localhost ~]# cd /mnt/cdrom/Packages/
[root@localhost Packages]# rpm -ivh e2fsprogs-libs-1.41.12-18.el6.x86_64.rpm
warning: e2fsprogs-libs-1.41.12-18.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Preparing... ########################################### [100%]
package e2fsprogs-libs-1.41.12-18.el6.x86_64 is already installed[root@localhost Packages]# rpm -ivh libcom_err-devel-1.41.12-18.el6.x86_64.rpm warning: libcom_err-devel-1.41.12-18.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY Preparing... ########################################### [100%] 1:libcom_err-devel ########################################### [100%]
[root@localhost Packages]# rpm -ivh e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm warning: e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY Preparing... ########################################### [100%] 1:e2fsprogs-devel ########################################### [100%]
2. Create local yum source and install compiler environment.
[root@localhost ~]# yum install gcc gcc-c++ -y
3. Unzip the extundelet package.
[root@localhost ~]# tar jxvf extundelete-0.2.4.tar.bz2 -C ~ extundelete-0.2.4/ extundelete-0.2.4/acinclude.m4 extundelete-0.2.4/missing extundelete-0.2.4/autogen.sh extundelete-0.2.4/aclocal.m4 extundelete-0.2.4/configure extundelete-0.2.4/LICENSE extundelete-0.2.4/README extundelete-0.2.4/install-sh extundelete-0.2.4/config.h.in extundelete-0.2.4/src/ extundelete-0.2.4/src/extundelete.cc extundelete-0.2.4/src/block.h extundelete-0.2.4/src/kernel-jbd.h extundelete-0.2.4/src/insertionops.cc extundelete-0.2.4/src/block.c extundelete-0.2.4/src/cli.cc extundelete-0.2.4/src/extundelete-priv.h extundelete-0.2.4/src/extundelete.h extundelete-0.2.4/src/jfs_compat.h extundelete-0.2.4/src/Makefile.in extundelete-0.2.4/src/Makefile.am extundelete-0.2.4/configure.ac extundelete-0.2.4/depcomp extundelete-0.2.4/Makefile.in extundelete-0.2.4/Makefile.am
4. Configuring, compiling, and installing extundelete packages
[root@localhost ~]# cd extundelete-0.2.4 [root@localhost extundelete-0.2.4]# ls acinclude.m4 aclocal.m4 autogen.sh config.h.in configure configure.ac depcomp install-sh LICENSE Makefile.am Makefile.in missing README src [root@localhost extundelete-0.2.4]# ./configure Configuring extundelete 0.2.4 Writing generated files to disk [root@localhost extundelete-0.2.4]# make make -s all-recursive Making all in src extundelete.cc:571: Warning: Unused parameters'flags' [root@localhost extundelete-0.2.4]# make install Making install in src /usr/bin/install -c extundelete '/usr/local/bin'
5. Prepare partitions for testing, / dev/sdb1 in ext4 format and mount them in / mnt/ext4 directory.
[root@localhost ~]# mkdir /mnt/ext4 [root@localhost ~]# mount /dev/sdb1 /mnt/ext4/ [root@localhost ~]# df -hT /mnt/ext4/ Filesystem Type Size Used Avail Use% Mounted on /dev/sdb1 ext4 20G 172M 19G 1% /mnt/ext4
6. Create test files.
[root@localhost ~]# cd /mnt/ext4/ [root@localhost ext4]# echo 1 > a [root@localhost ext4]# echo 2 > b [root@localhost ext4]# echo 3 > c [root@localhost ext4]# ls a b c lost+found
7. Delete test files.
[root@localhost ext4]# rm -f a b [root@localhost ext4]# ls c lost+found
8. Unload the corresponding partition.
[root@localhost ext4]# cd [root@localhost ~]# umount /mnt/ext4/
9. Restore deleted content.
[root@localhost ~]# extundelete /dev/sdb1 --restore-all NOTICE: Extended attributes are not restored. Loading filesystem metadata ... 160 groups loaded. Loading journal descriptors ... 24 descriptors loaded. Searching for recoverable inodes in directory / ... 2 recoverable inodes found. Looking through the directory structure for deleted files ... 0 recoverable inodes still lost.
10. The recovered files will be in the RECOVERED_FILES folder in the current directory.
[root@localhost ~]# ls RECOVERED_FILES/ a b
XFS Type File Backup and Recovery
The extundelete tool can only recover files of EXT type, but can not recover files of xfs type which are used by default in CentOS 7 system. There is no mature file recovery tool for xfs file system at present, so it is recommended to do a good job of data backup in advance to avoid data loss.
xfs-type files can be backed up and restored using xfsdump and xfsrestore tools. If the xfsdump and xfsrestore tools are not installed in the system, they can be installed through the yum install-y xfsdump command. Xfsdump backs up an xfs file system in inode order.
There are two backup levels for xfsdump: 0 for full backup and 1-9 for incremental backup. The default is 0.
Xfsdump-f backup storage location backup path or device file
- f: Specify the backup file directory
- L: Specify the label session label
- M: Specify device label media label
- s: Back up a single file, - s can't follow the path directly.
- When using xfsdump, you need to pay attention to the following limitations:
1.xfsdump does not support file system backup without mounting, so it can only backup mounted files.
2.xfsdump must use root privileges to operate (involving file system relationships);
3.xfsdump can only backup XFS file system;
4. Data backed up by xfsdump (archives or storage media) can only be parsed by xfsrestore.
5.xfsdump distinguishes backup files by UUID of file system, so it can't backup two file systems with the same UUID.
The location of xfsrestore-f restore file and the path of restored file
Demo
1. Prepare partitions for testing, / dev/sdb1 in ext4 format and mount them in / mnt/ext4 directory.
[root@localhost ~]# mkdir /mnt/xfs [root@localhost ~]# mount /dev/sdb1 /mnt/xfs/ [root@localhost ~]# df -hT /mnt/xfs/ Filesystem Type Size Used Avail Use% Mounted on /dev/sdb1 xfs 20G 33M 20G 1% /mnt/xfs
2. Create test files.
[root@localhost ~]# cd /mnt/xfs/ [root@localhost xfs]# mkdir test [root@localhost xfs]# touch a.txt [root@localhost xfs]# touch test/b.txt
3. You can use tree to view the directory structure.
[root@localhost ~]# yum install tree -y
[root@localhost ~]# tree /mnt/xfs/
/mnt/xfs/
├── a.txt
└── test
└── b.txt
1 directory, 2 files4. Back up the entire partition using the xfsdump command.
[root@localhost ~]# xfsdump -f /opt/dump_sdb1 /dev/sdb1 xfsdump: using file dump (drive_simple) strategy xfsdump: version 3.1.4 (dump format 3.0) - type ^C for status and control ============================= dump label dialog ============================== please enter label for this dump session (timeout in 300 sec) -> dump_sdb1 //Specify a backup session label session label entered: "dump_sdb1" --------------------------------- end dialog --------------------------------- xfsdump: level 0 dump of localhost.localdomain:/mnt/xfs xfsdump: dump date: Fri Sep 6 13:36:12 2019 xfsdump: session id: 74232f85-124c-4486-8d91-f35208534f74 xfsdump: session label: "dump_sdb1" xfsdump: ino map phase 1: constructing initial dump list xfsdump: ino map phase 2: skipping (no pruning necessary) xfsdump: ino map phase 3: skipping (only one dump stream) xfsdump: ino map construction complete xfsdump: estimated dump size: 21760 bytes xfsdump: /var/lib/xfsdump/inventory created ============================= media label dialog ============================= please enter label for media in drive 0 (timeout in 300 sec) -> sdb1 //Specifying device labels is a description of the device to be backed up. media label entered: "sdb1" --------------------------------- end dialog --------------------------------- xfsdump: creating dump session media file 0 (media 0, file 0) xfsdump: dumping ino map xfsdump: dumping directories xfsdump: dumping non-directory files xfsdump: ending media file xfsdump: media file size 22952 bytes xfsdump: dump size (non-dir files) : 0 bytes xfsdump: dump complete: 46 seconds elapsed xfsdump: Dump Summary: xfsdump: stream 0 /opt/dump_sdb1 OK (success) xfsdump: Dump Status: SUCCESS
5. View backup information and content.
[root@localhost ~]# xfsdump -I
file system 0:
fs id: f8805a3e-089e-4875-ad54-d31e5dc98835
session 0:
mount point: localhost.localdomain:/mnt/xfs
device: localhost.localdomain:/dev/sdb1
time: Fri Sep 6 13:36:12 2019
session label: "dump_sdb1"
session id: 74232f85-124c-4486-8d91-f35208534f74
level: 0
resumed: NO
subtree: NO
streams: 1
stream 0:
pathname: /opt/dump_sdb1
start: ino 68 offset 0
end: ino 70 offset 0
interrupted: NO
media files: 1
media file 0:
mfile index: 0
mfile type: data
mfile size: 22952
mfile start: ino 68 offset 0
mfile end: ino 70 offset 0
media label: "sdb1"
media id: cc32446f-42e8-489b-867f-84a55949c1fa
xfsdump: Dump Status: SUCCESS6. Delete the created test file and simulate data loss.
[root@localhost ~]# rm -rf /mnt/xfs/* [root@localhost ~]# tree /mnt/xfs/ /mnt/xfs/ 0 directories, 0 files
7. Recovery of missing files.
[root@localhost ~]# xfsrestore -f /opt/dump_sdb1 /mnt/xfs/
xfsrestore: using file dump (drive_simple) strategy
xfsrestore: version 3.1.4 (dump format 3.0) - type ^C for status and control
xfsrestore: searching media for dump
xfsrestore: examining media file 0
xfsrestore: dump description:
xfsrestore: hostname: localhost.localdomain
xfsrestore: mount point: /mnt/xfs
xfsrestore: volume: /dev/sdb1
xfsrestore: session time: Fri Sep 6 13:36:12 2019
xfsrestore: level: 0
xfsrestore: session label: "dump_sdb1"
xfsrestore: media label: "sdb1"
xfsrestore: file system id: f8805a3e-089e-4875-ad54-d31e5dc98835
xfsrestore: session id: 74232f85-124c-4486-8d91-f35208534f74
xfsrestore: media id: cc32446f-42e8-489b-867f-84a55949c1fa
xfsrestore: using online session inventory
xfsrestore: searching media for directory dump
xfsrestore: reading directories
xfsrestore: 2 directories and 3 entries processed
xfsrestore: directory post-processing
xfsrestore: restoring non-directory files
xfsrestore: restore complete: 0 seconds elapsed
xfsrestore: Restore Summary:
xfsrestore: stream 0 /opt/dump_sdb1 OK (success)
xfsrestore: Restore Status: SUCCESS
[root@localhost ~]# tree /mnt/xfs/
/mnt/xfs/
├── a.txt
└── test
└── b.txt
1 directory, 2 files